Non-profit organization data breaches expose donor financial information, employee and volunteer personal records, and sometimes sensitive data about the individuals a non-profit serves, such as clients of a healthcare, housing, or social services organization. These exposures can lead to identity theft, direct financial fraud, and scams that specifically target donors using stolen names, giving histories, and contact information to impersonate the organization or solicit further payments. Non-profits are frequently under-resourced when it comes to cybersecurity relative to the amount and sensitivity of the data they collect, which can make them attractive targets despite operating on limited budgets. Depending on the organization’s mission, a breach may also expose especially sensitive information about vulnerable populations the non-profit serves, raising additional privacy concerns beyond typical financial data. This page tracks confirmed data breaches at non-profit organizations, including what data was exposed, which companies notified regulators, and what affected individuals can do next to protect themselves.
Oak Hill, a Connecticut nonprofit serving people with disabilities, has confirmed that a 2025 network intrusion exposed clients’ Social Security numbers, driver’s license numbers, and medical records.
Oak Hill Data Breach Exposes Social Security Numbers and Medical Information Read More »
Steppingstone, Inc., a Massachusetts behavioral health and homeless services provider, notified clients that an employee email account was hacked, exposing personal details from a previously sent message.
Steppingstone Data Breach Exposes Names, Birth Dates, and Driver’s License Numbers Read More »
Harbor Developmental Disabilities Foundation, doing business as Harbor Regional Center, notified California regulators of a data breach that may have exposed clients’ personal and health information.
Harbor Regional Center Data Breach Exposes Personal and Health Information Read More »
UFCW Local 342 has notified regulators and affected individuals that unauthorized access to its systems compromised sensitive personal information, prompting concerns about identity theft among union members.
UFCW Local 342 Data Breach Exposes Social Security Numbers and Personal Data Read More »
54 Below, the Manhattan nonprofit cabaret venue, disclosed a data breach affecting roughly 13,622 people after an unauthorized actor accessed files containing Social Security numbers, financial account details, and driver’s license information.
54 Below Data Breach Exposes Social Security Numbers and Financial Information Read More »
A ShinyHunters extortion campaign exposed personal data belonging to over 2.3 million donors, students, alumni and supporters of Moody Bible Institute, including names, addresses, phone numbers and dates of birth.
Moody Bible Institute Data Breach Exposes Names, Emails and Dates of Birth Read More »
Legal Services of Long Island has disclosed a data breach that exposed the Social Security numbers, financial accounts, and health information of 94,434 people after an unauthorized party accessed its network and removed data.
The Fedcap Group has notified individuals that a data breach exposed their Social Security numbers and driver’s license numbers, prompting free credit monitoring and identity protection services.
The Fedcap Group Data Breach Exposes Social Security Numbers and Driver’s Licenses Read More »
Methodist Homes of Alabama & Northwest Florida discovered unauthorized network access between October 2 and October 14, 2024, later confirming on September 2, 2025, that hackers may have accessed patients', residents', and non-residents' names, Social Security numbers, driver's license numbers, health insurance details, and medical records. Affected individuals should immediately place a fraud alert or
Methodist Homes of Alabama & Northwest Florida Data Breach Read More »
UFCW Local No. 7 discovered suspicious network activity on December 11, 2024, later determining an unauthorized actor accessed files on December 10, 2024, containing members' names and Social Security numbers. No financial or payment card data was exposed. Confirmed on August 21, 2025, this affects union members whose personal information was stored in the compromised
UFCW Local No. 7 Data Privacy Incident: Immediate Steps You Can Take Read More »